Application Security Engineer

This is a remote position.

As an Application Security Engineer at Aspire, you will play a key role in identifying, validating, and remediating application and API vulnerabilities across our digital platforms. You will investigate findings from security assessment tools such as Wiz, Qualys, Snyk, and SonarQube, manually validate potential exploits, assess business impact, and collaborate closely with development teams to implement effective security fixes.

You will lead application security testing initiatives, manage SAST and DAST programs, conduct secure code reviews, and evaluate how AWS configurations impact application security. Working in a hands-on, security-focused environment, you will help reduce security risks, improve secure development practices, and ensure vulnerabilities are accurately prioritized and remediated. You will also contribute to threat modeling, security automation, and continuous improvement of application security processes.

• Triage and validate security findings from Wiz, Qualys, and automated or AI-driven penetration testing tools by reproducing exploits and identifying false positives.
  
• Assess vulnerabilities based on exploitability, business impact, data exposure, and overall risk, and track remediation through closure.
  
• Provide clear, actionable remediation guidance, including code-level recommendations, and review developer fixes to ensure vulnerabilities are fully resolved.
  
• Identify recurring vulnerability patterns and recommend root-cause solutions, including shared authorization libraries, secure coding standards, and secure-by-default configurations.
  
• Perform manual security testing of web applications and APIs, focusing on authentication, authorization, BOLA/IDOR, privilege escalation, session management, injection, and business logic flaws.
  
• Test REST and GraphQL APIs to identify access control weaknesses, authorization bypasses, and other OWASP API Security Top 10 vulnerabilities.
  
• Investigate shadow and undocumented APIs discovered by security tools and assess their exposure and associated risks.
  
• Conduct secure code reviews and threat modeling for new application features, APIs, and integrations.
  
• Manage and optimize SAST and DAST programs using Snyk, SonarQube, and Qualys Web Application Scanning (WAS), including custom rules, quality gates, scan configurations, and false-positive reduction.
  
• Configure and maintain authenticated DAST scans against web applications and APIs, ensuring meaningful coverage of application functionality and security controls.
  
• Correlate findings from Snyk, SonarQube, Qualys, and Wiz to identify vulnerabilities present in source code and exploitable in production environments.
  
• Integrate security testing into development workflows and CI/CD pipelines, establishing appropriate severity thresholds and security quality gates.
  
• Assess AWS configurations affecting application security, including IAM roles and policies, S3 bucket exposure, API Gateway, Lambda permissions, and secrets management.
  
• Validate cloud-to-application attack paths identified by Wiz, including scenarios where vulnerable applications operate with excessive AWS permissions.
  
• Review AWS WAF rules and recommend protective measures against identified application vulnerabilities and attack patterns.
  
• Use AWS Security Hub, GuardDuty, and Inspector findings to support vulnerability investigations, risk prioritization, and remediation efforts.
  
• Track vulnerability trends, remediation SLAs, and application security posture, providing clear reports and recommendations to engineering and security leadership.
  
• Collaborate with development, cloud, and security teams to strengthen application security practices and continuously improve vulnerability management processes.
  

• Bachelor’s degree in Information Security, Computer Science, Software Engineering, or a related field, or equivalent practical experience.
  
• 5+ years of hands-on experience in application security, penetration testing, or vulnerability research.
  
• Proven experience identifying and exploiting business logic flaws and access control vulnerabilities in REST and GraphQL APIs.
  
• Deep understanding of the OWASP Top 10 and OWASP API Security Top 10, including authentication, authorization, injection, and business logic vulnerabilities.
  
• Strong proficiency with manual application security testing tools, particularly Burp Suite Professional, including request manipulation and custom test case development.
  
• Hands-on experience operating, configuring, and tuning SAST and DAST tools such as Snyk, SonarQube, and Qualys, including vulnerability triage and false-positive reduction.
  
• Ability to read, analyze, and review application code in at least one modern programming language, such as Python, Java, Go, or JavaScript/TypeScript.
  
• Working knowledge of AWS security services and configurations, particularly IAM, S3, Lambda, and API Gateway, and their impact on application security
  
• Experience with Wiz, Qualys, or comparable cloud security posture management (CNAPP) and vulnerability management platforms, with the ability to turn automated scan results into validated, prioritized security findings.
  
• Experience integrating security testing into development workflows and collaborating with developers to implement secure coding practices.
  
• Strong understanding of vulnerability assessment, exploit validation, risk-based prioritization, and remediation lifecycle management.
  
• Excellent analytical and problem-solving skills, with the ability to distinguish exploitable vulnerabilities from scanner noise.
  
• Hands-on experience with SOAR platforms, including building playbooks and integrations to automate vulnerability management workflows.
  
• Experience with automated or AI-assisted penetration testing and continuous DAST platforms.
  
• Experience developing custom security rules and quality profiles in SonarQube or Snyk.
  
• AWS Certified Security – Specialty certification.
  
• Offensive security certifications such as OSCP, OSWE, BSCP, or GWAPT.
  
• Participation in bug bounty programs or experience publishing vulnerability research.
  
• Strong written and verbal communication skills, particularly in preparing developer-focused remediation guidance and security reports for leadership.
  
• Ability to influence development teams, drive remediation without direct authority, and work independently in a fast-paced, remote environment.
  
• Awareness or knowledge of IT security best practices as defined by ISO/SOC or similar.
  

In addition to a competitive long-term total compensation package with salary and performance-based bonus, we have a reward philosophy that goes beyond compensation.

• Be part of a remote-first organization where flexibility is embraced.
  
• Work and learn alongside talented engineers and technology leaders.
  
• Explore opportunities to learn and grow through technical and non-technical training programs.
  
• Gain global exposure by working on products with international teams and clients.
  
• Attend virtual and in-person international technology conferences to expand your knowledge and network.
  
• Exposure to working in an IT environment that adheres to rigorous security and compliance standards defined by ISO / SOC.